Is the ICO’s view of “lawful processing” under the GDPR wrong?
What makes processing “lawful” under the GDPR? The Information Commissioner (ICO) has stated that the word “lawfulness” has general application, as it did under the previous Data Protection Act (DPA1998). If my analysis is correct, this view is wrong; I think "lawfulness" is now limited in meaning to "compliance with the GDPR or DPA2018". If so, there is a significant risk that the level of the protection afforded to data subjects in the UK (and in Europe) is much diminished. First to




